When it comes to network reconnaissance, Ping scans are a crucial tool for detecting live hosts in
Nmap.
A powerful network scanning tool employs various techniques for host discovery, including sending TCP
synchronizing, TCP acknowledgment key and ICMP packets.
However, if a firewall blocks these requests, the host may mistakenly be considered offline.
Fortunately, Nmap offers a scanning technique called TCP synchronizing ping scan, which is particularly
useful for probing different ports to determine the online status of a host or identity.
Identify permissive filtering rules.
So let's dive into the TCP syn ping scan and its related options.
So to initiate a TCP syn ping scan using Nmap, you first open the terminal and enter Nmap.
S n and uppercase P.
S here.
And after that you will enter target domain or target IP address.
So let's enter our target domain here and here.
As you can see here, host is up.
So it bypassed the firewall and it now tells us that host is up.
So let's actually think like like how does it work?
So the s n option here interacts nmap to skip the port scanning phase and focus solely on host discovery.
The uppercase P.
S flag indicates that the usage of TCP synchronizing, ping scan, TCP syn ping scan and this type of
ping scan operates firstly in four ways in four steps here.
The first step is Nmap sends a TCP syn packet to port 80, a common port used for web services.
Step two If the port is closed, the host responds with a reset s t packet indicating no service is
available.
Step three If the port is open, the host responds with a TCP syn acknowledgement packet TCP syn ack
package.
So I mean the TCP sync and slash acknowledgement packet suggesting that a connection can be established
and finally the packet is sent to terminate the connection attempt.
So by appending the 24 here the Cidr notation to IP address or domain, we can here we can specify a
range of 254 IP addresses here.
And as you can see here, all of them is up here and here.
We scanned from this to there, here, and that's it.
How it worked here.
And I have an additional note for you that TCP synchronizing TCP syn ping scans are highly effective
for determining the presence of hosts on a network.
So while Nmap utilizes a default set of props, it allows for customization enabling you to select specific
ports to probe.
And then now let's explore more about TCP syn ping scan technique.
So we have two ways to start TCP syn ping scan technique, which is the first is unprivileged, which
you will just enter the Nmap here and then you run your parameters, commands, targets and so on.
But you can also run it with sudo.
So privileged user.
So running a TCP syn ping scan as an unprivileged user normal user who lacks the ability to send raw
packets, let's nmap to employ the connect function a system call to the send to send the TCP syn packet.
So in this scenario Nmap differentiates between syn ack response indicating a live host and the packet
received to an econ refused error indicating an online host here.
So we also need to discuss is firewalls and traffic filtering here.
So due to the prevalence of traffic filtering system, it's crucial to employ diverse ping scanning
techniques.
So consider this following example here.
So during a TCP synchronizing TCP syn ping scan, a host that is online might be misidentified as offline
if it's situated behind the traffic filtering system that blocks TCP or ICMP requests.
So to overcome the overcome this, a targeted scan can be performed on a specific open port such as
port 80 here.
So here we can use the Nmap, nmap, PS 80 here, and then after you enter the target IP or domain name
and here now what we are doing is we are scanning the port 80 here.
So you can also specify a list of ports to be used with PS option such as for example, we can use Nmap,
the PS and without space here you will add ports with comma here 2080, 21, 53 and so on after delivering
the ports.
But by the way, you can also use a port use ports to scan range, for example.
In order to do that, we will enter one and -1000.
And here in this case, we will scan all the ports in the target system from 1 to 1.
So here in this case, let's actually use the 8021, 2018, 21 and 53 here and 443, which is Https
protocol.
And we can also merge that with, for example, 101,000 here and we will enter the our target domain
or host IP address here.
And as you can see here, we got several open and service names here and here.
This, as you can see this, all of these are TCP ports.
And now what we're going to do is we will do the we will give the target here code Slate.com and here
here, for example, when scanning this code, telecom networks, it's beneficial to customize a sin
probe to include the Port one, three, eight and 443 because which are commonly used for posting here
for SSL here.
So and as you can see, duplicate port number specified are reluctant to using you have some coffee
or jolt and here that's.
That's because we are using 443 and after that we are scanning from 100 to 1000 here.
And that's why we.
So it's no problem here.
Actually, it just notifies us this is just a warning and not an error.
So we are in Nmap.
We also have.
Meant to discover hosts with TCP icky.
Ping scan so similar to the TCP syn ping scan, the TCP Aecac ping scan is employed to determine whether
a host is responsive.
So this technique aids in detecting hosts that block Syn packets and ICMP echo requests.
However, modern firewalls which track connection states typically blocks this method as it involves
sending bogus TCP and Ascii packets associated with non-existing connections.
So to perform this attack, TCP here to perform this attack, TCP is actually ping scan and observe
the online host.
You will follow these steps here.
Nmap of course, will actually use a pseudo nmap here and after that we will use the PR, a uppercase
PR, and after that you will enter the target domain or IP address here in this case code.com and enter
password and that's it.
And here we will get an output here.
And we can also see here and as you can see, 25% is done, 30 and so on.
So here.
And this is how TCP how you can start TCP ack keeping scan and observe the online host.
So here now we are waiting for it 31 process.
So it might take actually some time.
So while this running we will go to another command here.
So here and output will display a list of hosts that here.
Respond to the TCP acknowledgment packet Ascii packet sent indicating their online status here, for
example, we can also use this in local address here.
So nmap sn or notice on here.
So MPR 196192196
13 .0..
And here we will use this.
If slasher and 24 and here similar to two similar to TCP syn ping scan the here we can also use the.
S and here's n so this is an option.
Directs Nmap to skip port scanning so and solely focus on post discovery and here in this as you can
see here we got the here output here on this here par.
So here.
The par here like signifies the usage of the TCP ack key.
Ping scan and TCP ping scan operates in two steps here.
So nmap here.
The first step is Nmap sends an empty TCP packet with an EC flag set to the port 80 and this is the
default port, although alternative port list can be specified if the and the step two is if the host
is offline, it should not respond to this request.
However, if it's online, it will return an artist packet indicating its availability and the packets
are sent because the TCP IP packets sent are not associated with the existing valid connection.
And I have additional information for you which is so by default this TCP ack ping scans utilize port
80, but this behavior can be customized according to your requirements.
And it's important to note that privileged user privileges are required to create a root packet for
TCP acknowledgment.
Ack ping scans.
And in the absence of this pelagus Nmap resorts to performing a TCP syn ping scan instead.
So furthermore, you can specify the ports to be probed using this technique by listing after the PR
option.
But in this case, since we are telling Nmap to.
Ignore ports and in this case you need to delete it as n and add your own ports here.
So in conclusion, TCP syn syn and TCP ack ping scans are powerful methods for discovering hosts and
assessing their online status.
So this these techniques, along with their customization options, enable network administrators and
security professionals to gain insights into network topologies and potential vulnerabilities.